Actions

Whonix ™ for VirtualBox with CLI

From Whonix

< VirtualBox Testers Only Version




Ambox warning pn.svg.png Warning: This is the testers-only Whonix ™ version for VirtualBox with CLI. For the stable version, see: VirtualBox with CLI.

Ambox warning pn.svg.png Whonix ™ with CLI is a version suited for advanced users -- those who want Whonix ™ without a GUI. Everyone else should install the user-friendly Whonix ™ VirtualBox with XFCE.


1. Download Whonix ™ Whonix old logo.png CLI for Windows Windows logo - 2012.svg.png, MacOS Rsz osx.png and Linux Tux.png FREE


Ambox warning pn.svg.png By downloading, you acknowledge that you have read, understood and agreed to our Terms of Service and License Agreement.

Version: 15.0.1.3.4

Whonix ™
 		Download Security
without Verification 		Download Security
with Verification
Https long.png

Download

Medium High [1]
Button sig.png

OpenPGP Signature ( sha512 , sig )

- -
Crypto key.png Verify images using this Signing Key -


Verify the Whonix ™ Images Whonix ™ virtual machine images are cryptographically signed by Whonix developer Patrick Schleizer using OpenPGP. [2]

notice Digital signatures can increase security but this requires knowledge. Learn more about digital software signature verification.

If you know how to use an OpenPGP key, download the Whonix ™ Signing Key and the Whonix ™ signatures straight away.

Otherwise, use the following instructions:

Download Whonix ™ CLI

2. Install VirtualBox Virtualbox logo.png

  • Linux Tux.png: please press expand on the right side.

Hosts using a non-Debian OS: Tux.png

Install VirtualBox as per the normal mechanism for your Linux distribution. Whonix ™ has has been tested with, expects VirtualBox version 6.16 or higher.

For example VirtualBox version 5.2.18 has been reported to not be compatible.

Ubuntu hosts: Logo-ubuntusvg.png

Ubuntu bionic (18.04LTS) APT repository ships only VirtualBox version 5.2.18 and Whonix ™ will probably not work.

You might want to release-upgrade to Ubuntu focal (20.04LTS) which provides VirtualBox version 6.16.

Debian hosts: Debian.png

These instructions are for Debian buster, which is recommended. Other Debian releases might work, but this is untested. In that case, replace buster with the actual codename your release.

Note: this applies to Whonix ™ 15. Later Whonix ™ versions may use a codename different to buster.

Package virtualbox should be installed from Whonix repository. [3]

1. On the host.

Open a terminal.

2. Add Whonix ™ repository.

A) Download the Signing Key. 

wget https://www.whonix.org/patrick.asc

B) Optional: Check the Signing Key for better security.

C) Add Whonix's signing key. 

sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc

D) Add Whonix's APT repository. 

echo "deb https://deb.whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list

3. Update the package lists. 

sudo apt-get update

4. Install VirtualBox and Linux kernel headers. 

sudo apt-get install virtualbox linux-headers-$(dpkg --print-architecture)

The procedure is now complete.

3. Import Whonix ™ Whonix old logo.png into VirtualBox Virtualbox logo.png

For Whonix ™ VirtualBox import instructions, please press on expand on the right.

Start VirtualBox
OpenVirtualbox1.png

Click on File then choose Import Appliance...
Select Import2.png

Navigate and select Whonix ™ image and press next
Select whonix ova image3.png

Do NOT change anything! Just click on Import
Click import4.png

Then press Agree
Agree5.png

Wait until Whonix ™ .ova has been imported
Wait6.png

Now start both Whonix-Gateway ™ and Whonix-Workstation ™
Start both of them7.png

Miscellaneous

There are also Video Tutorials.

If you still need help, please check the Support page.

For command line import instructions, see footnote. [4]

4. Start Whonix ™

Starting Whonix ™ is simple.

Start VirtualBox → Double-click the Whonix-Gateway ™ and Whonix-Workstation ™.

First time user?

Whonix / Kicksecure default admin password is: changeme default username: user
default password: changeme

Whonix first time users warning Warning:

  • If you do not know what metadata or a man-in-the-middle attack is.
  • If you think nobody can eavesdrop on your communications because you are using Tor.
  • If you have no idea how Whonix works.

Then read the Design and Goals, Whonix ™ and Tor Limitations and Tips on Remaining Anonymous pages to decide whether Whonix is the right tool for you based on its limitations.

Footnotes and Experimental Spectre / Meltdown Defenses

Please press on expand on the right.

VirtualBox Stable Version | VirtualBox Testers Only Version

Testers only! For more information please press on expand on the right.

These experimental [archive] Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:

  1. A host microcode upgrade.
  2. A host kernel upgrade.
  3. A VM kernel upgrade.
  4. A "not vulnerable" result from spectre-meltdown-checker run on the host.
  5. Installation of the latest VirtualBox version. [5]
  6. All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.

To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed [archive] and the associated VirtualBox forum discussion [archive]. [6] Users must patiently wait for VirtualBox developers to fix this bug.

On the host. [7] [8] [9] [10] [11] [12] [13]

VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry o VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-sched on

VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-sched on

Info These steps must be repeated for every Whonix or non-Whonix VirtualBox VM, including multiple and custom VMs.

The above instructions only apply to the default VM names Whonix-Gateway ™ and Whonix-Workstation ™. Therefore, if Multiple Whonix-Workstation ™s and/or Multiple Whonix-Gateway ™s are configured, then repeat these instructions using the relevant name/s.


Footnotes[edit]

  1. ↑ It does not matter if the bulk download is done over an insecure channel if OpenPGP verification is used at the end.
  2. ↑ OpenPGP is a standard for data encryption that provides cryptographic privacy and authentication through the use of keys owned by its users.
  3. ↑ This is non-ideal but required since VirtualBox in unavailable in Debian buster / buster-backports. And it will not become available anytime soon either. See Unavailable in Debian stable and backports due to Licensing Issues. There is a chance VirtualBox will be available from Debian fasttrack [archive], see please add VirtualBox to fasttrack [archive]. Alternatively you could but this comes with different risks.
  4. ↑ On the Linux platform.
    1. Read License Agreement: 
    vboxmanage import Whonix-XFCE-15.0.1.3.4.ova --vsys 0 --eula show --vsys 1 --eula show

    2. Import Whonix-Gateway ™ and Whonix-Workstation ™. 

    vboxmanage import Whonix-XFCE-15.0.1.3.4.ova --vsys 0 --eula accept --vsys 1 --eula accept

  5. ↑ VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22 [archive].
  6. ↑ Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF) [archive]
  7. ↑

    --ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
    https://www.virtualbox.org/manual/ch08.html [archive]

    There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.

  8. ↑ https://www.virtualbox.org/manual/ch08.html [archive]

    --l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.

  9. ↑

    --l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646 [archive]”.
    https://www.virtualbox.org/manual/ch08.html [archive]

  10. ↑ https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646 [archive]

    For users not concerned by this security issue, the default mitigation can be disabled using

    VBoxManage modifyvm name --l1d-flush-on-sched off

    Since we want to enable the security feature we set --l1d-flush-on-sched on.

  11. ↑

    --spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
    https://www.virtualbox.org/manual/ch08.html [archive]

  12. ↑ According to this VirtualBox ticket [archive] --spec-ctrl should be set to on.
  13. ↑

    --nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier

Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Iconfinder news 18421.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png

Share: Twitter | Facebook

Did you know that anyone can edit the Whonix wiki [archive] to improve it?

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.

Retrieved from "https://www.whonix.org/w/index.php?title=VirtualBox_Testers_Only_Version/CLI&oldid=56729"